Privacy Policy
1. Scope and roles
This policy explains how Kordvik processes personal data. Two roles apply:
- For account and billing data (your email, login, subscription, invoices, service logs) we are the controller.
- For workspace content (contracts, vendors, contacts, and documents your team puts into Kordvik) your organisation is the controller and we are the processor, acting under the Data Processing Addendum.
2. Data we process
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Email address, password hash, 2FA/passkey credentials, phone (optional) | Sign-in, account security, service email (confirmation, reset, reminders) | Contract performance |
| Workspace content | Vendor and contract records, uploaded PDFs, contact names/emails, notes | Providing the service at your instruction | Processed on your behalf (see DPA) |
| Integration credentials | OAuth tokens for Slack, Google Drive, Microsoft services | Running the integrations you connect | Contract performance; stored encrypted at rest |
| Billing data | Plan, subscription status, invoice records; card details are held by Stripe, never by us | Charging for paid plans | Contract performance, legal obligation (bookkeeping) |
| Technical logs | IP address, timestamps, request metadata, audit-log entries | Security (rate limiting, lockout, audit), troubleshooting | Legitimate interest (running a secure service) |
3. AI processing stays on our infrastructure
Kordvik's AI features (contract extraction, risk review, benchmarking, negotiation drafts) run on a language model hosted on Kordvik's own infrastructure. Your contract text and documents are not sent to third-party AI providers, are not used to train models, and do not persist in the model server beyond the request. If this ever changes, we will update this policy and the subprocessor list in advance.
4. Cookies and analytics
Kordvik uses essential cookies only: the authentication session cookie and a request-forgery protection token. There are no advertising, analytics, or cross-site tracking cookies, which is why you see no cookie banner.
For aggregate usage statistics we may use cookieless analytics (Plausible): it sets no cookies, stores no persistent identifiers, and collects no personal data — only anonymous, aggregate page counts. It cannot track you across sites.
5. Sharing and subprocessors
We do not sell personal data. We share data only with the subprocessors needed to run the service (payment, email delivery, error monitoring, network/hosting) — the current list, with locations and safeguards, is maintained in the DPA — and with third-party services you choose to connect (for example Slack or Google Drive), at your instruction.
6. International transfers
We operate from the EU/EEA. Where a subprocessor processes data outside the EU/EEA (for example Stripe or Resend in the United States), transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
7. Retention
- Workspace content: kept while the workspace exists; removed from production systems promptly on deletion and from backups within the backup rotation window.
- Account data: kept while the account exists; deleted when you delete your account (self-serve, in Account → Personal data).
- Invoices and billing records: kept as long as bookkeeping law requires (7 years in Sweden).
- Application logs: kept for 14 days.
- Security and audit logs: kept for a limited period appropriate to their security purpose.
8. Your rights
Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Much of this is self-serve in the product: you can download your personal data and delete your account from Account → Personal data; workspace admins can download everything in a workspace (all records as JSON plus every stored contract document) from Settings → Workspace → Export all data, and Editors can export contracts and vendors as CSV. Every notification email has an unsubscribe link, and each member controls their own emails under Settings → Notifications. For anything else, email support@kordvik.com. You may also lodge a complaint with your supervisory authority — in Sweden, IMY (imy.se).
9. Security
Security measures — encryption of integration credentials at rest, TLS in transit, two-factor authentication and passkeys, tenant isolation, rate limiting, audit logging — are described on the security page.
10. Changes
We will announce material changes to this policy by email or in-app before they take effect.